diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2007-04-10 15:26:35 +0200 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2007-05-01 07:17:07 +0200 |
| commit | 8d5658c949e6d89edc579a1f112aeee3bc232a8e (patch) | |
| tree | f206d3f6809eeb0ca23c1999cf79aa294968b113 /fs/nfs/direct.c | |
| parent | NFS: Fix a race when doing NFS write coalescing (diff) | |
| download | linux-8d5658c949e6d89edc579a1f112aeee3bc232a8e.tar.xz linux-8d5658c949e6d89edc579a1f112aeee3bc232a8e.zip | |
NFS: Fix a buffer overflow in the allocation of struct nfs_read/writedata
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'fs/nfs/direct.c')
| -rw-r--r-- | fs/nfs/direct.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 2877744cb606..889de60f8a84 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -54,6 +54,7 @@ #include <asm/uaccess.h> #include <asm/atomic.h> +#include "internal.h" #include "iostat.h" #define NFSDBG_FACILITY NFSDBG_VFS @@ -271,7 +272,7 @@ static ssize_t nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned lo bytes = min(rsize,count); result = -ENOMEM; - data = nfs_readdata_alloc(pgbase + bytes); + data = nfs_readdata_alloc(nfs_page_array_len(pgbase, bytes)); if (unlikely(!data)) break; @@ -602,7 +603,7 @@ static ssize_t nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned l bytes = min(wsize,count); result = -ENOMEM; - data = nfs_writedata_alloc(pgbase + bytes); + data = nfs_writedata_alloc(nfs_page_array_len(pgbase, bytes)); if (unlikely(!data)) break; |